Score: 1.3 (>= 0.8) Infected Target: 192.168.1.216 Infector List: 88.130.184.189 Egg Source List: 88.130.184.189 C & C List: Peer Coord. List: Resource List: Observed Start: 09/14/2009 10:10:16.912 PDT Report End: 09/14/2009 10:10:19.981 PDT Gen. Time: 09/14/2009 10:10:21.279 PDT INBOUND SCAN EXPLOIT 88.130.184.189 (6) (10:10:16.912 PDT-10:10:19.981 PDT) event=1:22466 (2) {tcp} E2[rb] NETBIOS SMB-DS IPC$ unicode share access 445<-3417 (10:10:19.339 PDT) 445<-3400 (10:10:16.912 PDT) ------------------------- event=1:299913 (4) {tcp} E2[rb] SHELLCODE x86 0x90 unicode NOOP 2: 445<-3417 (10:10:19.960 PDT-10:10:19.981 PDT) 2: 445<-3400 (10:10:17.550 PDT-10:10:17.571 PDT) EXPLOIT (slade) EGG DOWNLOAD 88.130.184.189 (3) (10:10:21.839 PDT) event=1:2001683 {tcp} E3[rb] BLEEDING-EDGE Malware Windows executable sent from remote host 1033<-3451 (10:10:22.931 PDT) ------------------------- event=1:31000004 {tcp} E3[rb] BotHunter Scrip-based Windows egg download .exe 1022->3436 (10:10:21.839 PDT) ------------------------- event=1:5001684 {tcp} E3[rb] BotHunter Malware Windows executable (PE) sent from remote host 1033<-3451 (10:10:22.931 PDT) C and C TRAFFIC PEER COORDINATION OUTBOUND SCAN 88.130.184.189 (10:10:21.279 PDT) event=1:52123 {tcp} E5[rb] REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner 1022->3436 (10:10:21.279 PDT) ATTACK PREP DECLARE BOT tcpslice 1252948216.912 1252948219.982 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.216' ============================== SEPARATOR ================================